The second piece of Belgian national legislation has just been published in the Official Journal of Belgium (Moniteur Belge).The implementation act, as the law is dubbed, entered into force on its publication date 5 September.
The GDPR Implementation Act implements the Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offenses or the execution of criminal penalties, and on the free movement of such data.This act also abolished the former data protection legislation (1992 DP Act and its implementing Royal Decree of 2001).
Additionally, where the data controller is established in another EU Member State and uses a processor located in Belgium, the national law of that Member State applies to the processor, provided however that the processing takes place in that other Member State. The Belgian parliament also lowered the GDPR age of consent from 16 years to 13 years.
The Act provides restrictions on the data subject’s rights essentially in the following three cases:
detection of criminal offences;
protection of important objectives of general public interest;
control, inspection or regulatory missions related to the exercise of public authority.
In such cases, data controllers do not have to inform data subjects of the processing of their personal data. The right of data subjects is also limited, i.e. may not object to the processing of their data nor do they have the right to access or rectify such data in case of their personal data being processed for journalistic purposes and for the purpose of academic, artistic or literary expression, provided that the controller abides by certain ethical rules.
The texts of the law are available here: https://finances.belgium.be/sites/default/files/20180814_Rapport%20au%20Roi.pdf
Comments